From: Tom Lane <tgl@sss.pgh.pa.us>
To: Färber, Franz-Josef (StMUK) <Franz-Josef.Faerber@stmuk.bayern.de>
Cc: Noah Misch <noah@leadboat.com>
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: Extension pg_trgm, permissions and pg_dump order
Date: Wed, 25 May 2022 13:02:35 -0400
Message-ID: <1961551.1653498155@sss.pgh.pa.us> (raw)
In-Reply-To: <f8a4105f076544c180a87ef0c4822352@stmuk.bayern.de>
References: <f8a4105f076544c180a87ef0c4822352@stmuk.bayern.de>
[ redirecting to -bugs ]
=?iso-8859-1?Q?F=E4rber=2C_Franz-Josef_=28StMUK=29?= <Franz-Josef.Faerber@stmuk.bayern.de> writes:
> My minimal example goes like this: On the fresh container, execute
> ```sql
> CREATE ROLE limitedrole;
> CREATE SCHEMA ext_trgm;
> CREATE EXTENSION pg_trgm SCHEMA ext_trgm;
> GRANT USAGE ON SCHEMA ext_trgm TO limitedrole;
> SET ROLE limitedrole;
> CREATE TABLE x(y text);
> CREATE INDEX ON x USING gist(y ext_trgm.gist_trgm_ops);
> ```
> Dump the database with `pg_dump > /tmp/x`, then do
> ```sql
> DROP SCHEMA ext_trgm CASCADE; DROP TABLE x;
> ```
> (or alternatively create a fresh database and do a ` CREATE ROLE limitedrole;`)
> Then try to restore the dump with `cat /tmp/x | psql`.
> On version 14.2, this succeeds.
> On version 14.3, this fails with "ERROR: permission denied for schema ext_trgm".
I think what is happening here is that parse analysis of the index
expression is now being done as the owner of the table (already assigned
as limitedrole), as a consequence of the patch for CVE-2022-1552.
So basically, that patch has completely broken pg_dump's scheme for
when it can issue GRANTs. I'm not sure there is a simple fix :-(.
We could issue the GRANTs earlier but that is going to break some
other use-cases, if memory serves.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: tgl@sss.pgh.pa.us, Franz-Josef.Faerber@stmuk.bayern.de, noah@leadboat.com, pgsql-bugs@lists.postgresql.org
Subject: Re: Extension pg_trgm, permissions and pg_dump order
In-Reply-To: <1961551.1653498155@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox